0

I'm running the following aws cli command to create a cloudformation stack for a single ec2 instance.

$ aws cloudformation create-stack --template-body file://templates/single-instance.yml --stack-name single-instance --parameters ParameterKey=KeyName,ParameterValue=SOME-EXISTING-KEY-PAIR ParameterKey=InstanceType,ParameterValue=t2.micro

I'm using this template (converted to yaml): https://s3-us-west-2.amazonaws.com/cloudformation-templates-us-west-2/EC2InstanceWithSecurityGroupSample.template

While a cloudformation job does get created, it fails in the console with this error: AccessDenied. User doesn't have permission to call ec2:DescribeKeyPairs. Rollback requested by user, even though I seem to have the appropriate permissions in AWS. I'm able to run describe-key-pairs successfully otherwise (see below output):

$ aws ec2 describe-key-pairs --key-name SOME_NAME --region us-east-1
{
    "KeyPairs": [
        {
            "KeyName": "SOME_NAME",
            "KeyFingerprint": "xx:xx:xx:...."
        }
    ]
}
Improve this question
3
  • Are you creating the stack in the us-east-1 region? You explicitly set a region in the describe-key-pairs command but not the create-stack one
    – mhbrooks
    Jun 19, 2019 at 16:37
  • Ah, I didn't add the '--region' param there. Well I got the same result using 'us-east-1' to create the stack. Just figured out the issue though, it was related to me not using '--profile' option to use the right set of creds.
    – woozymj
    Jun 20, 2019 at 14:14
  • Glad you found it, for future reference cloudtrail will show failed requests (from valid users) and give you details on who made them and why they failed. Very useful for tracking down auth issues.
    – mhbrooks
    Jun 20, 2019 at 15:52

1 Answer 1

Reset to default
0

Figured it out, it was related to me not using '--profile' option to use the right set of creds contained in ~/.aws/credentials.

Improve this answer
4
  • I'm actually running into this exact same issue. I tried adding the profile option but that didn't help. Did you have to change anything to your permission policies as well?
    – Daniel
    Jun 28, 2019 at 12:54
  • 1
    @Daniel Well, cloudformation runs with a separate set of IAM permissions I believe. Are you using two-factor auth like STS token in your creds or just normal id/key?
    – woozymj
    Jul 1, 2019 at 8:07
  • @woozmj Yes! I'm using 2FA which was causing the problem. I ended up using a role delegation that has the permissions to create a stack.
    – Daniel
    Jul 26, 2019 at 13:59
  • @Daniel Awesome!
    – woozymj
    Aug 2, 2019 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.